System and Method for Generation of a Heuristic

ABSTRACT

A system and method for generating a heuristic is provided. A heuristic is capable of identifying data patterns. The method includes: extracting a data set from multiple input sources; creating a set of unique elements used across the data set; organizing the data set into a geometric structure; grouping portions of the data in the geometric structure into a plurality sub geometric structures; determining base attributes for each sub geometric structure using the set of unique elements; identifying trends in the base attributes among the sub geometric structures; and outputting the heuristic as a combination of the base attributes and the trends.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a system and method for generating aheuristic that is capable of identifying data patterns. Moreparticularly, the present invention relates to a system and method forautomatically creating a heuristic to be used in conjunction with acognitive fingerprinting system and method.

2. Description of the Related Art

In the security field, most anti-virus (AV) products rely onpre-computed signatures to identify viruses and threats. However, thereis not always enough time for a threat to be found and analyzed, asignature engineered, and an update delivered to users before they aretargeted.

Similarly, methods are needed to prevent data theft by unauthorizedusers. For example, if login credentials for an individual user fallinto unauthorized hands, the party possessing these credentials may beable to log into a system or network for which these credentials provideaccess, and over time, remove proprietary or confidential informationfrom a secure environment. Thus, there exists a need to detect thescenario where legitimate login credentials are being utilized byunauthorized persons, particularly when the theft of data is “subtle”and occurs over a period of time. Multi-factor authentication schemessuch as retina and fingerprint scans address the issue of validatingidentity, however they can be defeated or circumvented when anauthorized user indulges in unauthorized removal or theft ofinformation. Additionally, it can be cost-prohibitive to put suchdefenses in a typical business network at all entry points, such asdesktop computers, mobile endpoints and Thin clients.

Methods are needed to detect when legitimate users with authorizedcredentials are still engaging in unauthorized behavior. Recently, therehave been a number of high-profile incidents where an authorized userengages in behavior beyond the scope of their authorization andsubsequently steals and releases confidential information. While accesscontrol limitations such as attaching permissions to data exist, theseprotections do not protect widespread data theft when a user haslegitimate access to the data. Thus, there exists a need to detectatypical behavior by a user on a network to prevent such securitybreaches.

The use of neural network based recognition systems is common withinmany industries. These systems typically process inputs as sequences ofbits which are connected to a number of cells or neurons. Theseapproaches are theoretically content agnostic in that they do not haveto account differently for text, images or other forms of input. But inpractice, this generality can impose penalties in the form of slowerlearning processes and the necessity of creating “deep” structures inorder to capture enough pattern information that would allow the systemto deliver meaningful results and subsequent recognition.

Other learning approaches are highly tuned to the type of content beingprocessed. For example, some Inductive Logic Programming (ILP) methodsprocess higher-level concepts such as “facts” and “truths” and encodetheir implications to create reasoning chains. These approachestypically require developing evaluators for context-specific attributes.In many instances, approaches like ILP lack flexibility because theyrequire a lot of domain specific information, customization and may notscale to handle variations of problems from adjacent domains.

SUMMARY OF THE INVENTION

Aspects of the present invention address at least the above-mentionedproblems and/or disadvantages and provide at least the advantagesdescribed below. Accordingly, an aspect of the present invention is togenerate a heuristic that is capable of identifying data patterns.Another aspect of the present invention is to provide a heuristic to beused in conjunction with a cognitive fingerprinting method. A corecognitive fingerprint is used to identify and respond to a predeterminedgoal state by analyzing system data through the use of patternrecognizers which implement heuristics. Response actions can be executedif a core fingerprint falls within the threshold of a target goal (wherea goal can be an event such as whether malware is detected orunauthorized data theft is detected). In contrast to an approach thatwould capture a single system state, a core cognitive fingerprint canrepresent the temporal evolution of a system over time.

In accordance with another aspect of the present invention, a method forgenerating a heuristic is provided. The method includes: extracting adata set from multiple input sources; creating a set of unique elementsused across the data set; organizing the data set into a geometricstructure; grouping portions of the data in the geometric structure intoa plurality of sub geometric structures; determining base attributes foreach sub geometric structure using the set of unique elements;identifying trends in the base attributes among the sub geometricstructures; and outputting the heuristic as a combination of the baseattributes and the trends. In accordance with another aspect of thepresent invention, a computer system for creating a heuristic isprovided.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other aspects, features, and advantages of certainexemplary embodiments of the present invention will be more apparentfrom the following description taken in conjunction with theaccompanying drawings, in which:

FIG. 1 is a block diagram of a heuristic generation process according toan exemplary embodiment of the present invention;

FIG. 2 is a block diagram of a cognitive fingerprinting processaccording to an exemplary embodiment of the present invention;

FIG. 3 is an exemplary system according to an embodiment of the presentinvention.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

The following description is provided to assist in a comprehensiveunderstanding of exemplary embodiments of the invention as defined bythe claims and their equivalents. It includes various specific detailsto assist in that understanding; however these specific details are tobe regarded as merely exemplary. Accordingly, those of ordinary skill inthe art will recognize that various changes and modifications of theembodiments described herein can be made without departing from thescope and spirit of the invention.

FIG. 1 is a block diagram of a heuristic generation process according toan exemplary embodiment of the present invention. Referring now to FIG.1, data from which a heuristic will be generated is obtained at step110. Data can be obtained from a user computer system, a wireless phone,a network server, and can arrive or be extracted from multiple datasources, implementing multiple formats, etc. The data is assessed forunique elements associated therewith and a dictionary is then createdfrom the set of unique elements across the input data. In oneembodiment, if the input data is binary then the dictionary can be allunique bytes across the binary data. In another embodiment, if the inputdata is text then the dictionary can be all unique words across thetext. In yet another embodiment, if the input data is images then thedictionary can be the unique colors used across the set of images. Theseare only examples of the types of data that can form a dictionary andany type of data can be used to form a unique set of elements across thedata.

Once each element in the dictionary has been compiled, magnitude valuesare assigned to each element in the dictionary in step 120. A magnitudevalue represents a consistent measure of “strength” for a particularelement across the dictionary. For example, if the dictionary is allunique words used in a set of text, then the magnitude of each word inthe dictionary can be the frequency of occurrence of that word acrossthe set of text. In another example, if the dictionary is a set ofunique bytes then the magnitude value of each element in the dictionarycan be the value of the byte (i.e. a number between 0 and 255). In yetanother example, if the dictionary is a set of colors then the magnitudevalue of each element in the dictionary can be the RGB number of thecolor. These are only examples of the types of magnitudes that can bedefined and any function that estimates a measure of strength for aparticular element can be used. The magnitude value can also benormalized across the input data by setting the magnitude of the entiredictionary to be 1.

In step 130, every element in the input data is organized into ageometric structure along with its corresponding magnitude so thatsubsequent geometric operations can be performed on the data. In oneembodiment, the geometric structure is a two dimensional grid. Thegeometric structure is configured to allow the structure to be assymmetric as possible. Thus, if the geometric structure is a twodimensional grid then the input data is organized such that the gridmost closely resembles a square. In one embodiment, the elements areentered into the grid left to right, row to row until the grid is filledup.

For example, if our input data is the string “this text string will beused as an example of organizing input into a geometric structure,” thenthe data can be organized into a two dimensional grid as follows:

In step 140, the geometric structure is broken up into sub structures.This allows for the method to subsequently analyze for base propertiesof information separately for the data in each sub structure. Forexample, if we have the 4×4 grid provided above we can break up it intofour 2×2 sub-grids as follows:

Sub structures can take any shape and form, for example they can be assmall as a 1×1 cell containing only one word.

After the data in the geometric structure is broken up into substructures, in step 150 base properties are generated for each substructure corresponding to presence, magnitude, and position values. Thepresence base property is the strength of unique elements in the substructure. For example, if a sub structure contains 10 of 100 uniquedictionary elements then the presence value would be 0.1. The magnitudebase element is the sum of the magnitudes of the elements in the substructure. The position base element is the percentage of the mostsignificant element in the sub structure. The most significant elementcan be defined the most frequent word or another measurement can beused.

Once base properties are calculated for the data in the sub structures,trends are calculated across the sub structures in step 160. A libraryof different functions can be applied to each row, column, diagonal, orother division of sub structures in the geometric figure. In oneembodiment, a linear progression function is used to find a coefficientvalue a and a constant value c across each row, column, etc. Similarly,other functions may define patterns for other columns and rows.

After we have generated base properties and calculated trends, in step170 the heuristic is outputted. A heuristic definition may include, inpart, references to the sub geometric structures. The heuristic containsall base properties of information for each sub structure previouslygenerated, as well as all of the trends calculated. All valuesassociated with all properties identified previously are coefficientsfor each corresponding property. For example, a heuristic could contain:

SAMPLE HEURISTIC Properties of tests Values/coefficients gridsize 4  4presence grid 1 45% presence grid 2 23% presence grid 3 32% presencegrid 4 59% magnitude grid 1 121 magnitude grid 2 110 . . . . . . Fitrow1 a = 4 c = 6 lib func = #101 Fit row2 a = 5 c = 7 lib func = #1021

From such a heuristic it is possible to draw conclusions from input datasuch as when a painting is made by Monet, the pallete tends to be verygentile (i.e. the strength of presence in low-mid range). Anotherexample conclusion might be that when a stock is a great buy, its pricehistory tends to follow library function 538 in the first sub structure,629 in the second sub structure, and 631 in the third substructure.Other embodiments may provide indicators for detecting data securitythreats, such as the presence of malware, hacking attempts, unauthorizedbehavior by authorized users, and phishing attempts.

FIG. 2 is a more detailed diagram of a cognitive fingerprinting processaccording to an exemplary embodiment of the present invention.

In step 210, a user can specify extraction criteria such as sources fromwhich data will be extracted. The processor extracts data according tothe extraction criteria. Exemplary sources can be system logs,processes, and databases. Data sources can be specified from a usercomputer system, a wireless phone, a network server, and can includespecific files such as CSV files, database tables, polled informationfrom WMI (Windows Management Instrumentation), APIs (ApplicationProgramming Interface) or information gathered from Web Services and Websites. Extraction criteria can also include, for each individual datasource, specifying a window of time from which the data will beextracted. For example, a sliding window can be specified to onlyinclude data from the previous 4 hours of a system log, whereas adifferent or similar time frame might be applied to a second datasource, e.g. a Twitter feed. Extraction criteria can also includingsettings for throttling, controlling, and caching the data received fromthe sources to control the execution speed or resource usage whenextracting data.

In step 220, pattern recognizers are provided. The purpose of a patternrecognizer (PR) is to generate a value indicating the strength of thepresence of one or more qualities in, or attributes of, the data. In oneexemplary embodiment, a pattern recognizer may be implemented viasoftware operating on a computer system. The pattern recognizer may beconfigured to implement a heuristic function. A heuristic function isable to process a stream input and respond with a strength of matchmeasure. The output of heuristic functions can be normalized in order tocompare multiple heuristics. For example, heuristics can be specified tooutput a real number between 0 and 1. Heuristics can also be specifiedto content type, for example text, images, signal or video. Specifyingthe content type of a heuristic allows a pattern recognizer to becontent type specific while the overall fingerprinting process remainscontent agnostic. In one embodiment, the heuristics generated by theprocess described in FIG. 1 can be used in a pattern recognizer.

In step 230, the extracted data from step 210 is passed through thepattern recognizers to generate a set of elements, the length of the setequivalent to the number of pattern recognizers. Thus, if we have 10pattern recognizers, a set of 10 elements will be created. The set ofelements can be described as a vector. For example, if we have n patternrecognizers (PR) each one can be described (PRi) where i, {1≦i≦n} Givenan input C, PRi (C)=ai where ai is a vector comprised of n elements.

PR1(C)=a1

PR2(C)=a2 . . . .

PRn(C)=an and ai,{0≦ai≦1}.

Thus, given an input C, PR(C)=A where A is a vector {ai} and i, {1≦i≦n}.A denotes a “set of elements” for input C.

In one embodiment, the method does not limit nor require every patternrecognizer to provide a meaningful output. For example, if a streamcomprised of image data is run across a text focused heuristic patternrecognizer, the output may simply be 0. Pattern recognizers may beconfigured to determine if the provided input is supported by a givenpattern recognizer. If a mismatch is identified, a pre-determined systemwide output value, such as 0, may be used to indicate this mismatch.Subsequent processing may identify the output as a mismatch and mayoptionally discard that particular pattern recognizer's output.

In another embodiment, the input sources are already defined as text,image, signal or video and only relevant pattern recognizers will beapplied to any input stream while others are turned off.

In step 240 the set of elements generated in step 230 are ran throughrelationship tests and identified relationships are extracted and addedto the set of elements. Relationship test functions take the initial setof elements and extract mathematical relationships existing between theelements, such as equality, correlation, mapping via function, andmagnitude comparison. For example:

Inverse (ai,aj) can produce

$\quad\begin{pmatrix}n \\2\end{pmatrix}$

identified relationship indications between 0 and 1, for all (1≦i≦n),(1≦j≦n), based on how correlated the deviation of ai and aj is inopposite directions on the number line.

Correlation(ai,aj) can produce

$\quad\begin{pmatrix}n \\2\end{pmatrix}$

identified relationship indications between 0 and 1, for all (1≦i≦n),(1≦j≦n), based a statistical relationship involving dependence toindicate the level of correlation between ai and aj.

Min(ai,aj), Max(ai,aj) can produce

$\quad\begin{pmatrix}n \\2\end{pmatrix}$

identified identified relationship indications between 0 and 1, for all(1≦i≦n), (1≦j≦n), based on whether ai is small when aj is large, or viceversa.

Thus, if we have a set of n elements run through k relationship testseach producing

$\quad\begin{pmatrix}n \\2\end{pmatrix}$

values, then

$k{\quad\begin{pmatrix}n \\2\end{pmatrix}}$

elements are added to the initial set of elements to yield a new set ofelements which now has

$n + {k{\quad\begin{pmatrix}n \\2\end{pmatrix}}}$

values.

In step 250, the set of elements are applied against learned weights.Learned weights are values which can be adjusted to give certainheuristics more ‘power’ to influence results than others. In oneembodiment, the default values of all of the weights are 1 but can beadjusted later in system learning. The output of this process results ina final set of elements which is the final cognitive fingerprint. Forexample, if a user of the system determines that two core cognitivefingerprints, which are within a certain threshold, do not actuallyindicate the same problem (e.g. theft of data), the user may providesuch feedback to the system. This feedback, in turn, will cause weightsfor the pattern recognizers that caused the threshold convergence to bedecremented.

In step 260, the final cognitive fingerprint can be stored in afingerprint database and/or sent to a fuzzy comparator for furtheraction. The fuzzy comparator makes an optimum decision by evaluatingeach data element in the final cognitive fingerprint. It can beappreciated that the final cognitive fingerprint can be plotted as avector with a point in space. Fingerprints of various types of contentcan similarly be plotted in this space. When other similar pieces ofcontent similar are encountered, a fingerprint comparison may yieldinsights into similarly and mutual relevance.

For each fingerprint calculated for content C1, C2, . . . , Cm, thedistance between these fingerprints can be calculated. The square of thedistances can be summed and represented as a scalar value. When thisdistance exceeds a certain threshold there is no match. The matchfunction itself provides a fuzzy notion of matching, i.e. a real numberbetween 0 and 1, rather than a true or false Boolean value.

Two fingerprints can be compared by taking a sum of squared differencesbetween each vector element and determining if the result falls below athreshold value. When the user or app provides system learning regardingthe efficacy or usefulness of a fingerprint this feedback is captured.If the fingerprint is not useful, the heuristics which have the highestdeltas between them can be strengthened by incrementing theircorresponding weight multipliers in vector W. Over time, this minimizesthe noise from heuristics that cause a fingerprint to be associated withinaccurate goal states.

In step 270, the fuzzy comparator sends the final cognitive fingerprintto an action engine which launches an action if the fingerprint iswithin the threshold of a target goal. For example, if the fingerprintmatches or approaches an espionage/data theft goal state then an actionmight trigger a system shut down and email an alert to the systemadministrator. Similarly, if the system indicates a fingerprintapproaching a possible malware goal state then an action could be toquarantine the possible malware and email an alert to the systemadministrator.

In step 280, a user can reconfigure the goals or system learning. A usercan edit, delete, or add goals by entering a goal name 5 a, a goalaction 5 b, a goal description 5 c, and criteria 5 d that define systemstates the user is interested in identifying, predicting, and takingaction on. Thus, a user can define what a goal is, and what it lookslike when it is encountered. Example criteria could be the systemcrashing or a CPU workload percentage.

FIG. 3 depicts a functional block diagram of computer system. Computersystem 702 includes a central processing unit (CPU) 702, a memory 704,an interconnect bus 706, and a display 716. The CPU 702 may include asingle microprocessor or a plurality of microprocessors for configuringcomputer system 702 as a multi-processor system. The memory 704illustratively includes a main memory and a read only memory. Thecomputer 702 also includes the mass storage device 708 having, forexample, various disk drives, tape drives, etc. The main memory 704 alsoincludes dynamic random access memory (DRAM) and high-speed cachememory. In operation and use, the main memory 704 stores at leastportions of instructions and data for execution by the CPU 702.

The mass storage 708 may include one or more magnetic disk or tapedrives or optical disk drives, for storing data and instructions for useby the CPU 702. At least one component of the mass storage system 708,preferably in the form of a disk drive or tape drive, stores thedatabase used for providing the decision assistance of system of thepresent invention. The mass storage system 708 may also include one ormore drives for various portable media, such as a floppy disk, a compactdisc read only memory (CD-ROM), or an integrated circuit non-volatilememory adapter (i.e. PCMCIA adapter) to input and output data and codeto and from the computer system.

An exemplary embodiment of a fingerprinting platform workflow is forpredicting motor failure. A motor going below 5,000 RPM can be definedas a disaster event which a user might want to predict.

A user can include input sources from the motor such as the motor speed,the motor head level, the motor oil level, and the usage data of themotor which can be streamed in real time.

A user can also include specifying a 4 hour sliding window of time sothat only data from the last 4 hours will be extracted. These extractioncriteria provide the parameters for the extracted data.

Pattern recognizers are provided which take the extracted data andanalyze different patterns found in the data. PR1 outputs an averagemotor heat over the time period value, PR2 outputs an average oil levelover the time period value, PR3 outputs a frequency of use value, andPR4 outputs a volatility of use value.

The processor runs extracted data through the 4 pattern recognizers toand PR1 outputs 0.4 corresponding to its average motor heat heuristic,the PR2 outputs 0.5 corresponding to its average oil level heuristic,PR3 outputs 0.9 corresponding to its frequency of use heuristic, and PR4 outputs 0.2 corresponding to its volatility of use heuristic. Thus,the set of elements is [0.4, 0.5, 0.9, 0.2].

The set of elements is applied against a set of weights which only 0.5for the first element and 1 for all of the other values. Thus, the motorheat heuristic is deemphasized. The final fingerprint is the set ofelements [0.2, 0.5, 0.9 and 0.2] because only the first element wasmultiplied by 0.5.

This fingerprint can be sent to a fuzzy comparator. The fuzzy comparatorhas in its database 20 other 5,000 RPM disaster event fingerprints thathave been previously identified, one for each time the event occurred.The fuzzy comparator compares the current fingerprint with the disasterset of fingerprints by calculating a distance in space. The fuzzycomparator might send the fingerprint to an action engine if thedistance is within a predetermined threshold of a goal state. The actionengine takes corrective action because the fingerprint falls within athreshold of the disaster goal state approximated by the 20 otherfingerprints.

A user can reconfigure previous goals by associating or dissociating newfingerprints with the goals or create new goals for further learning. Itcan be appreciated that in a complex system like a factory floor, manythings may lead to the motor speed going below 5,000 RPM. Each of the 20fingerprints may actually correspond to different reasons for failure.If we create a cluster diagram of those 20, we may find that there are 3groupings (using a statistical technique known as clustering). Thiswould suggest that while there are 20 failures, there are really 3reasons why. Thus, different actions can be created for the differentgroupings.

Other embodiments for the fingerprinting platform can be for detectingmalware by creating cognitive fingerprints that identify and predict thepresence of malware; detecting hacking by identifying and clusteringfingerprints that immediately preceded a hack; and detecting phishing bycreating cognitive fingerprints which correlate messages, theircontents, links and payloads with what they actually do on the system.

The exemplary systems and methods illustrated herein may be described interms of functional block components, screen shots, optional selectionsand various processing steps. It should be appreciated that suchfunctional blocks may be realized by any number of hardware and/orsoftware components configured to perform the specified functions. Forexample, the system may employ various integrated circuit components,e.g., memory elements, processing elements, logic elements, look-uptables, and the like, which may carry out a variety of functions underthe control of one or more microprocessors or other control devices.Similarly, the software elements of the system may be implemented withany programming or scripting language such as C, C++, C#, Java,JavaScript, VBScript, Macromedia Cold Fusion, COBOL, Microsoft ActiveServer Pages, assembly, PERL, PHP, AWK, Python, Visual Basic, SQL StoredProcedures, PL/SQL, any UNIX shell script, and extensible markuplanguage (XML) with the various algorithms being implemented with anycombination of data structures, objects, processes, routines or otherprogramming elements. Further, it should be noted that the system mayemploy any number of conventional techniques for data transmission,signaling, data processing, network control, and the like. Stillfurther, the system could be used to detect or prevent security issueswith a client-side scripting language, such as JavaScript, VBScript orthe like.

The systems and methods of the present disclosure may be embodied as acustomization of an existing system, an add-on product, a processingapparatus executing upgraded software, a stand alone system, adistributed system, a method, a data processing system, a device fordata processing, and/or a computer program product. Accordingly, anyportion of the system or a module may take the form of a processingapparatus executing code, an internet based embodiment, an entirelyhardware embodiment, or an embodiment combining aspects of the internet,software and hardware. Furthermore, the system may take the form of acomputer program product on a computer-readable storage medium havingcomputer-readable program code means embodied in the storage medium. Anysuitable computer-readable storage medium may be utilized, includinghard disks, CD-ROM, optical storage devices, magnetic storage devices,and/or the like.

Although some of the drawings illustrate a number of operations in aparticular order, operations which are not order dependent may bereordered and other operations may be combined or broken out. While somereordering or other groupings are specifically mentioned, others will beapparent to those of ordinary skill in the art and so do not present anexhaustive list of alternatives. Moreover, it should be recognized thatthe stages could be implemented in hardware, firmware, software or anycombination thereof.

The system and method is described herein with reference to screenshots, block diagrams and flowchart illustrations of methods, apparatus(e.g., systems), and computer program products according to variousembodiments. It will be understood that each functional block of theblock diagrams and the flowchart illustrations, and combinations offunctional blocks in the block diagrams and flowchart illustrations,respectively, can be implemented by computer program instructions.

These computer program instructions may be loaded onto a general purposecomputer, special purpose computer, or other programmable dataprocessing apparatus to produce a machine, such that the instructionsthat execute on the computer or other programmable data processingapparatus create means for implementing the functions specified in theflowchart block or blocks. These computer program instructions may alsobe stored in a computer-readable memory that can direct a computer orother programmable data processing apparatus to function in a particularmanner, such that the instructions stored in the computer-readablememory produce an article of manufacture including instruction meanswhich implement the function specified in the flowchart block or blocks.The computer program instructions may also be loaded onto a computer orother programmable data processing apparatus to cause a series ofoperational steps to be performed on the computer or other programmableapparatus to produce a computer-implemented process such that theinstructions which execute on the computer or other programmableapparatus provide steps for implementing the functions specified in theflowchart block or blocks.

Accordingly, functional blocks of the block diagrams and flowchartillustrations support combinations of means for performing the specifiedfunctions, combinations of steps for performing the specified functions,and program instruction means for performing the specified functions. Itwill also be understood that each functional block of the block diagramsand flowchart illustrations, and combinations of functional blocks inthe block diagrams and flowchart illustrations, can be implemented byeither special purpose hardware-based computer systems which perform thespecified functions or steps, or suitable combinations of specialpurpose hardware and computer instructions.

The term “non-transitory” is to be understood to remove only propagatingtransitory signals per se from the claim scope and does not relinquishrights to all standard computer-readable media that are not onlypropagating transitory signals per se. Stated another way, the meaningof the term “non-transitory computer-readable medium” should beconstrued to exclude only those types of transitory computer-readablemedia which were found in In Re Nuijten to fall outside the scope ofpatentable subject matter under 35 U.S.C. §101.

Although the disclosure includes a method, it is contemplated that itmay be embodied as computer program instructions on a tangiblecomputer-readable carrier, such as a magnetic or optical memory or amagnetic or optical disk. All structural, chemical, and functionalequivalents to the elements of the above-described exemplary embodimentsthat are known to those of ordinary skill in the art are expresslyincorporated herein by reference and are intended to be encompassed bythe present claims. Moreover, it is not necessary for a device or methodto address each and every problem sought to be solved by the presentdisclosure, for it to be encompassed by the present claims. Furthermore,no element, component, or method step in the present disclosure isintended to be dedicated to the public regardless of whether theelement, component, or method step is explicitly recited in the claims.No claim element herein is to be construed under the provisions of 35U.S.C. 112, sixth paragraph, unless the element is expressly recitedusing the phrase “means for.” As used herein, the terms “comprises”,“comprising”, or any other variation thereof, are intended to cover anon-exclusive inclusion, such that a process, method, article, orapparatus that comprises a list of elements does not include only thoseelements but may include other elements not expressly listed or inherentto such process, method, article, or apparatus.

Changes and modifications may be made to the disclosed embodimentswithout departing from the scope of the present disclosure. These andother changes or modifications are intended to be included within thescope of the present disclosure, as expressed in the following claims.

What is claimed:
 1. A computer implemented method of generating aheuristic that is capable of identifying data patterns, comprising:extracting a data set from multiple input sources; creating a set ofunique elements used across the data set; organizing the data set into ageometric structure; grouping portions of the data in the geometricstructure into a plurality of sub geometric structures; determining baseattributes for each sub geometric structure using the set of uniqueelements; identifying trends in the base attributes among the subgeometric structures; and outputting the heuristic as a combination ofthe base attributes and the trends.
 2. The computer implemented methodof claim 1, further comprising: assigning a magnitude value to eachelement in the set of unique elements.
 3. The computer implementedmethod of claim 2, wherein one of the base attributes determined is apresence attribute.
 4. The computer implemented method of claim 2,wherein one of the base attributes determined is a magnitude attribute.5. The computer implemented method of claim 2, wherein one of the baseattributes determined is a position attribute.
 6. The computerimplemented method of claim 2, wherein outputs of all base attributesare normalized amongst each other.
 7. The computer implemented method ofclaim 2, wherein the trends are identified by using a linear progressionfunction.
 8. The computer implemented method of claim 2, wherein thegeometric structure is a two dimensional grid.
 9. The computerimplemented method of claim 2, wherein the heuristic is used in apattern recognizer to create a core cognitive fingerprint.
 10. Thecomputer implemented method of claim 2, further comprising: generating aheuristic definition including references to the sub geometricstructures.
 11. A computer system, comprising: a processor; and memorycoupled to the processor and storing instructions that, when executed bythe processor, cause the computer system to: extract a data set frommultiple input sources; create a set of unique elements used across thedata set; organize the data set into a geometric structure; groupportions of the data in the geometric structure into a plurality of subgeometric structures; determine base attributes for each sub geometricstructure using the set of unique elements; identify trends in the baseattributes among the sub geometric structures; and output the heuristicas a combination of the base attributes and the trends.
 12. The computersystem of claim 11, wherein the memory further stores instructions tocause the processor to assign a magnitude value to each element in theset of unique elements.
 13. The computer system of claim 12, wherein oneof the base attributes determined is a presence attribute.
 14. Thecomputer system of claim 12, wherein one of the base attributesdetermined is a magnitude attribute.
 15. The computer system of claim12, wherein one of the base attributes determined is a positionattribute.
 16. The computer system of claim 12, wherein the memoryfurther stores instructions to cause the processor to normalize outputsof all base attributes amongst each other.
 17. The computer system ofclaim 12, wherein the memory further stores instructions to cause theprocessor to identify the trends using a linear progression function.18. The computer system of claim 12, wherein the geometric structure isa two dimensional grid.
 19. The computer system of claim 12, wherein thememory further stores instructions to cause the processor to use apattern recognizer to create a core cognitive fingerprint from theheuristic.
 20. The computer system of claim 12, wherein the memoryfurther stores instructions to cause the processor to generate aheuristic definition including references to the sub geometricstructures.